docs(qa): #293 verify acceptance — pool_only reciprocal, global route trace #815

2026-06-05T14:00:43Z

PlasticDigits commented

2026-06-05 14:00:43 +00:00

(Migrated from gitlab.com)

Summary

Clarifies GitLab #293 verification acceptance criteria. Global best-execution swap quotes on LocalTerra are asymmetric by design (different routes per direction on lopsided deploy topology). The original report is not a decimal bug.

Changes:

scripts/qa/verify-issue-293.sh — splits live check into [3a] global route trace (informational) and [3b] pool_only=true reciprocal gate (≤5%, OE-1 acceptance)
docs/testing.md — documents acceptance scope
skills/AGENTS_LOCALNET_TRADING_SWARM.md — OE-1 reciprocal uses pool_only

Verification checklist

Acceptance item	Command	Result
Swarm liquidity unit tests	`make test-swarm-liquidity`	PASS (5/5)
TS swarm profile tests	`cd packages/localnet-trading-swarm && npm run test:run`	PASS (14/14)
Swarm bootstrap + launch	`make swarm-bootstrap-liquidity && make swarm-launch`	PASS
Global route asymmetry documented	`make verify-issue-293` [3a]	DOCUMENTED (EMBER/CORAL 36,000×, TOPAZ/ONYX 66×, ONYX/CORAL 22,800×)
Direct-pool reciprocal ≤5%	`make verify-issue-293` [3b]	PASS (3.57–3.67%)
Full verify script	`make verify-issue-293`	PASS (6/6)

Issue: https://gitlab.com/PlasticDigits/cl8y-dex-terraclassic/-/work_items/293

Note

Low Risk
Documentation and local QA script only; no changes to indexer, contracts, or dApp runtime behavior.

Overview
GitLab #293 verification is tightened so OE-1 acceptance no longer treats global best-execution route/solve quotes as a reciprocal sanity check. Docs and the swarm agent playbook now state that ≤5% reciprocal deviation applies only to pool_only=true direct-pool quotes on hub pairs; asymmetric multi-hop vs direct routes on LocalTerra are expected, not a decimal bug.

scripts/qa/verify-issue-293.sh splits the live indexer step into [3a] an informational global route trace (hop counts, path strings, rev/reciprocal ratio) and [3b] the real gate on pool_only=true solves. Pass/fail for OE-1 follows [3b]; [3a] must complete successfully to document route asymmetry. Indexer fetches add small delays between calls.

^{Reviewed by Cursor Bugbot for commit 787b60dfc1. Bugbot is set up for automated code reviews on this repo. Configure here.}

## Summary Clarifies GitLab #293 verification acceptance criteria. Global best-execution swap quotes on LocalTerra are **asymmetric by design** (different routes per direction on lopsided deploy topology). The original report is **not a decimal bug**. **Changes:** - `scripts/qa/verify-issue-293.sh` — splits live check into [3a] global route trace (informational) and [3b] `pool_only=true` reciprocal gate (≤5%, OE-1 acceptance) - `docs/testing.md` — documents acceptance scope - `skills/AGENTS_LOCALNET_TRADING_SWARM.md` — OE-1 reciprocal uses pool_only ## Verification checklist | Acceptance item | Command | Result | |-----------------|---------|--------| | Swarm liquidity unit tests | `make test-swarm-liquidity` | PASS (5/5) | | TS swarm profile tests | `cd packages/localnet-trading-swarm && npm run test:run` | PASS (14/14) | | Swarm bootstrap + launch | `make swarm-bootstrap-liquidity && make swarm-launch` | PASS | | Global route asymmetry documented | `make verify-issue-293` [3a] | DOCUMENTED (EMBER/CORAL 36,000×, TOPAZ/ONYX 66×, ONYX/CORAL 22,800×) | | Direct-pool reciprocal ≤5% | `make verify-issue-293` [3b] | PASS (3.57–3.67%) | | Full verify script | `make verify-issue-293` | PASS (6/6) | Issue: https://gitlab.com/PlasticDigits/cl8y-dex-terraclassic/-/work_items/293  --- > [!NOTE] > **Low Risk** > Documentation and local QA script only; no changes to indexer, contracts, or dApp runtime behavior. > > **Overview** > GitLab **#293** verification is tightened so **OE-1 acceptance** no longer treats global best-execution `route/solve` quotes as a reciprocal sanity check. Docs and the swarm agent playbook now state that **≤5% reciprocal deviation** applies only to **`pool_only=true`** direct-pool quotes on hub pairs; asymmetric multi-hop vs direct routes on LocalTerra are **expected**, not a decimal bug. > > **`scripts/qa/verify-issue-293.sh`** splits the live indexer step into **[3a]** an informational global route trace (hop counts, path strings, rev/reciprocal ratio) and **[3b]** the real gate on `pool_only=true` solves. Pass/fail for OE-1 follows **[3b]**; **[3a]** must complete successfully to document route asymmetry. Indexer fetches add small delays between calls. > > <sup>Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit 787b60dfc117ad4dd3c7eeafc864c140d3e73971. Bugbot is set up for automated code reviews on this repo. Configure [here](https://www.cursor.com/dashboard/bugbot).</sup>

ghost1 commented

2026-06-05 14:00:51 +00:00

(Migrated from gitlab.com)

changed the description

PlasticDigits commented

2026-06-05 14:00:53 +00:00

(Migrated from gitlab.com)

mentioned in issue #293

ghost1 commented

2026-06-05 14:00:56 +00:00

(Migrated from gitlab.com)

changed the description

ghost1 commented

2026-06-05 14:01:44 +00:00

(Migrated from gitlab.com)

Stale Security Review comment

Cursor Bugbot has reviewed your changes and found 1 potential issue.
^{Bugbot Autofix is ON. A cloud agent has been kicked off to fix the reported issue.}

^{Reviewed by Cursor Bugbot for commit d2f598ea04. Configure here.}

<details> <summary>Stale Security Review comment</summary>  Cursor Bugbot has reviewed your changes and found 1 potential issue. <sup>Bugbot Autofix is [ON](https://www.cursor.com/dashboard/bugbot). A cloud agent has been kicked off to fix the reported issue. </sup>  <sup>Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit d2f598ea04d7545d70a01ad3b41e681b53de931a. Configure [here](https://www.cursor.com/dashboard/bugbot).</sup> </details>

ghost1 commented

2026-06-05 14:01:45 +00:00

(Migrated from gitlab.com)

[3a] failure aborts verify

Medium Severity

The informational [3a] Python block is assigned without || true while the script uses set -e. Any indexer or parsing error there exits the whole run before [3b], the summary, and stop-swarm.sh, unlike the old single check and unlike [3b].

^{Reviewed by Cursor Bugbot for commit d2f598ea04. Configure here.}

### [3a] failure aborts verify **Medium Severity**  The informational `[3a]` Python block is assigned without `|| true` while the script uses `set -e`. Any indexer or parsing error there exits the whole run before `[3b]`, the summary, and `stop-swarm.sh`, unlike the old single check and unlike `[3b]`.    <div><a href="https://cursor.com/open?link=eyJ2ZXJzaW9uIjoxLCJ0eXBlIjoiQlVHQk9UX0ZJWF9JTl9DVVJTT1IiLCJkYXRhIjp7InJlZGlzS2V5IjoiYnVnYm90OjYxN2RhM2E3LTcyZjktNGE4Yi1iYWQwLWYzYTQ1ZDQ3NjI0ZCIsImVuY3J5cHRpb25LZXkiOiJlWWw2ekZHREI2aC03aTQ0dE9nVTFmd1d3Nlh6Ry1WUHpGaW1SWG9oU19FIiwiYnJhbmNoIjoiY3Vyc29yL2dpdGxhYi1pc3N1ZS12ZXJpZmljYXRpb24tY2U5YyIsInJlcG9Pd25lciI6IlBsYXN0aWNEaWdpdHMiLCJyZXBvTmFtZSI6ImNsOHktZGV4LXRlcnJhY2xhc3NpYyJ9fQ" target="_blank" rel="noopener noreferrer"><picture><source media="(prefers-color-scheme: dark)" srcset="https://cursor.com/assets/images/fix-in-cursor-dark.png"><source media="(prefers-color-scheme: light)" srcset="https://cursor.com/assets/images/fix-in-cursor-light.png"><img alt="Fix in Cursor" width="115" height="28" src="https://cursor.com/assets/images/fix-in-cursor-dark.png"></picture></a> <a href="https://cursor.com/agents?link=eyJ2ZXJzaW9uIjoxLCJ0eXBlIjoiQlVHQk9UX0ZJWF9JTl9XRUIiLCJkYXRhIjp7InJlZGlzS2V5IjoiYnVnYm90OjYxN2RhM2E3LTcyZjktNGE4Yi1iYWQwLWYzYTQ1ZDQ3NjI0ZCIsImVuY3J5cHRpb25LZXkiOiJlWWw2ekZHREI2aC03aTQ0dE9nVTFmd1d3Nlh6Ry1WUHpGaW1SWG9oU19FIiwiYnJhbmNoIjoiY3Vyc29yL2dpdGxhYi1pc3N1ZS12ZXJpZmljYXRpb24tY2U5YyIsInJlcG9Pd25lciI6IlBsYXN0aWNEaWdpdHMiLCJyZXBvTmFtZSI6ImNsOHktZGV4LXRlcnJhY2xhc3NpYyIsInByTnVtYmVyIjo5NywiY29tbWl0U2hhIjoiZDJmNTk4ZWEwNGQ3NTQ1ZDcwYTAxYWQzYjQxZTY4MWI1M2RlOTMxYSIsInByb3ZpZGVyIjoiZ2l0bGFiIiwiaG9zdG5hbWUiOiJnaXRsYWIuY29tIn19" target="_blank" rel="noopener noreferrer"><picture><source media="(prefers-color-scheme: dark)" srcset="https://cursor.com/assets/images/fix-in-web-dark.png"><source media="(prefers-color-scheme: light)" srcset="https://cursor.com/assets/images/fix-in-web-light.png"><img alt="Fix in Web" width="99" height="28" src="https://cursor.com/assets/images/fix-in-web-dark.png"></picture></a></div> <sup>Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit d2f598ea04d7545d70a01ad3b41e681b53de931a. Configure [here](https://www.cursor.com/dashboard/bugbot).</sup>

ghost1 commented

2026-06-05 14:02:22 +00:00

(Migrated from gitlab.com)

changed this line in version 2 of the diff

changed this line in [version 2 of the diff](/PlasticDigits/cl8y-dex-terraclassic/-/merge_requests/97/diffs?diff_id=1836870160&start_sha=d2f598ea04d7545d70a01ad3b41e681b53de931a#174bdbec0dd22494f2085dda07074915ffc9189e_122_122)

ghost1 commented

2026-06-05 14:02:22 +00:00

(Migrated from gitlab.com)

added 1 commit

9683f1e2 - fix(verify-293): prevent [3a] informational trace from aborting verify

Compare with previous version

added 1 commit <ul><li>9683f1e2 - fix(verify-293): prevent [3a] informational trace from aborting verify</li></ul> [Compare with previous version](/PlasticDigits/cl8y-dex-terraclassic/-/merge_requests/97/diffs?diff_id=1836870160&start_sha=d2f598ea04d7545d70a01ad3b41e681b53de931a)

PlasticDigits commented

2026-06-05 14:02:29 +00:00

(Migrated from gitlab.com)

Security review

Commit reviewed: d2f598ea04d7545d70a01ad3b41e681b53de931a

Scope: scripts/qa/verify-issue-293.sh, docs/testing.md, skills/AGENTS_LOCALNET_TRADING_SWARM.md (docs + localnet QA verification only; no indexer, contract, or frontend runtime changes).

Method: Diff review and trace of indexer HTTP usage in the new [3a] / [3b] Python blocks (urllib.request.urlopen against VERIFY293_INDEXER_URL, query params built from indexer /api/v1/tokens contract addresses and fixed hub symbols).

Outcome: FINDINGS: 0 medium+

Inline threads: none (no medium+ issues on this diff).

Security review: no medium+ findings on this diff.

Prior Bugbot note on [3a] aborting under set -e is a QA reliability concern (informational block can skip [3b] cleanup path), not an exploitable authn/authz, injection, or secret-leak issue in deployed software — not re-reported here.

Automated security review (Cursor).

## Security review **Commit reviewed:** `d2f598ea04d7545d70a01ad3b41e681b53de931a` **Scope:** `scripts/qa/verify-issue-293.sh`, `docs/testing.md`, `skills/AGENTS_LOCALNET_TRADING_SWARM.md` (docs + localnet QA verification only; no indexer, contract, or frontend runtime changes). **Method:** Diff review and trace of indexer HTTP usage in the new `[3a]` / `[3b]` Python blocks (`urllib.request.urlopen` against `VERIFY293_INDEXER_URL`, query params built from indexer `/api/v1/tokens` contract addresses and fixed hub symbols). **Outcome:** **FINDINGS: 0** medium+ **Inline threads:** none (no medium+ issues on this diff). --- Security review: no medium+ findings on this diff. Prior Bugbot note on `[3a]` aborting under `set -e` is a **QA reliability** concern (informational block can skip `[3b]` cleanup path), not an exploitable authn/authz, injection, or secret-leak issue in deployed software — not re-reported here. *Automated security review (Cursor).*

ghost1 commented

2026-06-05 14:02:33 +00:00

(Migrated from gitlab.com)

changed the description

ghost1 commented

2026-06-05 14:03:21 +00:00

(Migrated from gitlab.com)

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{Bugbot Autofix is ON. A cloud agent has been kicked off to fix the reported issue.}

^{Reviewed by Cursor Bugbot for commit 9683f1e210. Configure here.}

Cursor Bugbot has reviewed your changes and found 1 potential issue.  <a href="https://cursor.com/open?link=eyJ2ZXJzaW9uIjoxLCJ0eXBlIjoiQlVHQk9UX0ZJWF9BTExfSU5fQ1VSU09SIiwiZGF0YSI6eyJyZWRpc0tleSI6ImJ1Z2JvdC1tdWx0aTowY2Y5N2MzYy00MTNmLTRmOTMtYmFhMC1kYzdiMmMyNTc3YTUiLCJlbmNyeXB0aW9uS2V5IjoiZG5RdF9iZl9MZlVIVVV0clF0V3NhQWE1ODc0LU9Tal9ZWmprNmhJcG5DayIsImJyYW5jaCI6ImN1cnNvci9naXRsYWItaXNzdWUtdmVyaWZpY2F0aW9uLWNlOWMiLCJyZXBvT3duZXIiOiJQbGFzdGljRGlnaXRzIiwicmVwb05hbWUiOiJjbDh5LWRleC10ZXJyYWNsYXNzaWMifX0" target="_blank" rel="noopener noreferrer"><picture><source media="(prefers-color-scheme: dark)" srcset="https://cursor.com/assets/images/fix-in-cursor-dark.png"><source media="(prefers-color-scheme: light)" srcset="https://cursor.com/assets/images/fix-in-cursor-light.png"><img alt="Fix All in Cursor" width="115" height="28" src="https://cursor.com/assets/images/fix-in-cursor-dark.png"></picture></a>   <sup>Bugbot Autofix is [ON](https://www.cursor.com/dashboard/bugbot). A cloud agent has been kicked off to fix the reported issue. </sup>  <sup>Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit 9683f1e2101f919531487db21d1b11d6b3f948e7. Configure [here](https://www.cursor.com/dashboard/bugbot).</sup>

ghost1 commented

2026-06-05 14:03:28 +00:00

(Migrated from gitlab.com)

False pass after 3a failure

Medium Severity

The script always records a PASS for global route asymmetry documentation after live checks, even when the [3a] Python trace exits with an error (|| true swallows failure) and prints no route lines. A green make verify-issue-293 can then claim asymmetry was documented when [3b] alone succeeded.

Additional Locations (1)

scripts/qa/verify-issue-293.sh#L78-L122

^{Reviewed by Cursor Bugbot for commit 9683f1e210. Configure here.}

### False pass after 3a failure **Medium Severity**  The script always records a PASS for global route asymmetry documentation after live checks, even when the `[3a]` Python trace exits with an error (`|| true` swallows failure) and prints no route lines. A green `make verify-issue-293` can then claim asymmetry was documented when `[3b]` alone succeeded.    <details> <summary>Additional Locations (1)</summary> - [`scripts/qa/verify-issue-293.sh#L78-L122`](https://gitlab.com/PlasticDigits/cl8y-dex-terraclassic/-//blob/9683f1e2101f919531487db21d1b11d6b3f948e7/scripts/qa/verify-issue-293.sh#L78-L122) </details> <div><a href="https://cursor.com/open?link=eyJ2ZXJzaW9uIjoxLCJ0eXBlIjoiQlVHQk9UX0ZJWF9JTl9DVVJTT1IiLCJkYXRhIjp7InJlZGlzS2V5IjoiYnVnYm90OjczNWNiOTA3LTU1ZmMtNGE0MS05ZDNiLTY0YWU3OTA0NTBlNSIsImVuY3J5cHRpb25LZXkiOiJnUWFYa0Nsck45d1c5ejhLZ3U5elJJbUVyUG9xRm14QzlvQmZGRHdoVXBVIiwiYnJhbmNoIjoiY3Vyc29yL2dpdGxhYi1pc3N1ZS12ZXJpZmljYXRpb24tY2U5YyIsInJlcG9Pd25lciI6IlBsYXN0aWNEaWdpdHMiLCJyZXBvTmFtZSI6ImNsOHktZGV4LXRlcnJhY2xhc3NpYyJ9fQ" target="_blank" rel="noopener noreferrer"><picture><source media="(prefers-color-scheme: dark)" srcset="https://cursor.com/assets/images/fix-in-cursor-dark.png"><source media="(prefers-color-scheme: light)" srcset="https://cursor.com/assets/images/fix-in-cursor-light.png"><img alt="Fix in Cursor" width="115" height="28" src="https://cursor.com/assets/images/fix-in-cursor-dark.png"></picture></a> <a href="https://cursor.com/agents?link=eyJ2ZXJzaW9uIjoxLCJ0eXBlIjoiQlVHQk9UX0ZJWF9JTl9XRUIiLCJkYXRhIjp7InJlZGlzS2V5IjoiYnVnYm90OjczNWNiOTA3LTU1ZmMtNGE0MS05ZDNiLTY0YWU3OTA0NTBlNSIsImVuY3J5cHRpb25LZXkiOiJnUWFYa0Nsck45d1c5ejhLZ3U5elJJbUVyUG9xRm14QzlvQmZGRHdoVXBVIiwiYnJhbmNoIjoiY3Vyc29yL2dpdGxhYi1pc3N1ZS12ZXJpZmljYXRpb24tY2U5YyIsInJlcG9Pd25lciI6IlBsYXN0aWNEaWdpdHMiLCJyZXBvTmFtZSI6ImNsOHktZGV4LXRlcnJhY2xhc3NpYyIsInByTnVtYmVyIjo5NywiY29tbWl0U2hhIjoiOTY4M2YxZTIxMDFmOTE5NTMxNDg3ZGIyMWQxYjExZDZiM2Y5NDhlNyIsInByb3ZpZGVyIjoiZ2l0bGFiIiwiaG9zdG5hbWUiOiJnaXRsYWIuY29tIn19" target="_blank" rel="noopener noreferrer"><picture><source media="(prefers-color-scheme: dark)" srcset="https://cursor.com/assets/images/fix-in-web-dark.png"><source media="(prefers-color-scheme: light)" srcset="https://cursor.com/assets/images/fix-in-web-light.png"><img alt="Fix in Web" width="99" height="28" src="https://cursor.com/assets/images/fix-in-web-dark.png"></picture></a></div> <sup>Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit 9683f1e2101f919531487db21d1b11d6b3f948e7. Configure [here](https://www.cursor.com/dashboard/bugbot).</sup>

ghost1 commented

2026-06-05 14:04:26 +00:00

(Migrated from gitlab.com)

changed this line in version 3 of the diff

changed this line in [version 3 of the diff](/PlasticDigits/cl8y-dex-terraclassic/-/merge_requests/97/diffs?diff_id=1836875247&start_sha=9683f1e2101f919531487db21d1b11d6b3f948e7#174bdbec0dd22494f2085dda07074915ffc9189e_182_185)

ghost1 commented

2026-06-05 14:04:26 +00:00

(Migrated from gitlab.com)

added 1 commit

787b60df - Fix false pass when [3a] global route trace fails in verify-issue-293

Compare with previous version

added 1 commit <ul><li>787b60df - Fix false pass when [3a] global route trace fails in verify-issue-293</li></ul> [Compare with previous version](/PlasticDigits/cl8y-dex-terraclassic/-/merge_requests/97/diffs?diff_id=1836875247&start_sha=9683f1e2101f919531487db21d1b11d6b3f948e7)

ghost1 commented

2026-06-05 14:04:39 +00:00

(Migrated from gitlab.com)

changed the description

PlasticDigits commented

2026-06-05 14:05:21 +00:00

(Migrated from gitlab.com)

Security review

Commit reviewed: 787b60dfc117ad4dd3c7eeafc864c140d3e73971

Scope: scripts/qa/verify-issue-293.sh, docs/testing.md, skills/AGENTS_LOCALNET_TRADING_SWARM.md (docs + localnet QA verification only; no indexer, contract, or frontend runtime changes).

Method: Full MR diff review; traced indexer HTTP in [3a] / [3b] (urllib.request.urlopen to VERIFY293_INDEXER_URL, query params from indexer /api/v1/tokens addresses and fixed hub symbols). Re-checked follow-ups since d2f598e (set +e / PY_GLOBAL_RC around [3a]) — QA reliability only, no new attacker-controlled sinks.

Outcome: FINDINGS: 0 medium+

Inline threads: none (no medium+ issues on this diff).

Security review: no medium+ findings on this diff.

Prior review on d2f598e conclusions unchanged. Post-merge commits fix [3a] abort / false-pass under set -e; not authn/authz, injection, SSRF in deployed software, or secret leakage (operator-run local script; default indexer URL unchanged).

Automated security review (Cursor).

## Security review **Commit reviewed:** `787b60dfc117ad4dd3c7eeafc864c140d3e73971` **Scope:** `scripts/qa/verify-issue-293.sh`, `docs/testing.md`, `skills/AGENTS_LOCALNET_TRADING_SWARM.md` (docs + localnet QA verification only; no indexer, contract, or frontend runtime changes). **Method:** Full MR diff review; traced indexer HTTP in `[3a]` / `[3b]` (`urllib.request.urlopen` to `VERIFY293_INDEXER_URL`, query params from indexer `/api/v1/tokens` addresses and fixed hub symbols). Re-checked follow-ups since `d2f598e` (`set +e` / `PY_GLOBAL_RC` around `[3a]`) — QA reliability only, no new attacker-controlled sinks. **Outcome:** **FINDINGS: 0** medium+ **Inline threads:** none (no medium+ issues on this diff). --- Security review: no medium+ findings on this diff. Prior review on `d2f598e` conclusions unchanged. Post-merge commits fix `[3a]` abort / false-pass under `set -e`; not authn/authz, injection, SSRF in deployed software, or secret leakage (operator-run local script; default indexer URL unchanged). *Automated security review (Cursor).*

PlasticDigits commented

2026-06-05 14:05:35 +00:00

(Migrated from gitlab.com)

Security review

Commit reviewed: 787b60dfc117ad4dd3c7eeafc864c140d3e73971

Scope: scripts/qa/verify-issue-293.sh, docs/testing.md, skills/AGENTS_LOCALNET_TRADING_SWARM.md (documentation and localnet QA verification only; no indexer, contract, or frontend runtime changes).

Method: Full diff review on latest MR head; traced HTTP usage in new [3a] / [3b] Python blocks (urllib.request.urlopen to VERIFY293_INDEXER_URL, query params from indexer /api/v1/tokens addresses and fixed hub symbols; pool_only=true on [3b] only). Re-checked prior review at d2f598ea after fix commit for regressions.

Outcome: FINDINGS: 0 medium+

Inline threads: none (no medium+ issues on this diff).

Security review: no medium+ findings on this diff.

The [3a]/PY_GLOBAL_RC change is QA correctness (avoid false PASS / preserve set -e flow); it does not introduce authn/authz, injection, SSRF in deployed surfaces, or secret exposure beyond the existing local-only VERIFY293_INDEXER_URL pattern (operator-controlled env, default 127.0.0.1:3001).

Automated security review (Cursor).

## Security review **Commit reviewed:** `787b60dfc117ad4dd3c7eeafc864c140d3e73971` **Scope:** `scripts/qa/verify-issue-293.sh`, `docs/testing.md`, `skills/AGENTS_LOCALNET_TRADING_SWARM.md` (documentation and localnet QA verification only; no indexer, contract, or frontend runtime changes). **Method:** Full diff review on latest MR head; traced HTTP usage in new `[3a]` / `[3b]` Python blocks (`urllib.request.urlopen` to `VERIFY293_INDEXER_URL`, query params from indexer `/api/v1/tokens` addresses and fixed hub symbols; `pool_only=true` on `[3b]` only). Re-checked prior review at `d2f598ea` after fix commit for regressions. **Outcome:** **FINDINGS: 0** medium+ **Inline threads:** none (no medium+ issues on this diff). --- Security review: no medium+ findings on this diff. The `[3a]`/`PY_GLOBAL_RC` change is QA correctness (avoid false PASS / preserve `set -e` flow); it does not introduce authn/authz, injection, SSRF in deployed surfaces, or secret exposure beyond the existing local-only `VERIFY293_INDEXER_URL` pattern (operator-controlled env, default `127.0.0.1:3001`). *Automated security review (Cursor).*

PlasticDigits commented

2026-06-05 14:21:34 +00:00

(Migrated from gitlab.com)

resolved all threads